Subject: Re: [keyassure] Introducing draft-josefsson-keyassure-tls-00.txt

From: "Jeffrey A. Williams" <[email-masked]>
Date: Mon, 23 Aug 2010 15:45:59 -0500 (GMT-05:00)

Stephen and all,

-----Original Message-----
>From: Stephen Schultze <[email-masked]>
>Sent: Aug 23, 2010 2:54 PM
>To: [email-masked]
>Subject: Re: [keyassure] Introducing draft-josefsson-keyassure-tls-00.txt
>
>On Aug 23, 2010, at 3:45 PM, Nicholas Weaver wrote:
>>>> b)  It requires that all validators understand the semantics of  
>>>> the certificates rather than just treating them as opaque binary  
>>>> blobs.
>>>
>>> Certainly not all DNSSEC validators (that's what you seem to be  
>>> implying below).  Only the TLS module needs to be changed to first  
>>> pull out the key.  The rest of the DNSSEC chain works as normal.
>>
>> Except the model existing for DNSSEC is that an ARBITRARY RR can be  
>> validated by any DNSSEC cache or intermediatry.  By only validating  
>> a portion of the data, you break this model for no benefit: such an  
>> RR would be very different from every other resource record in terms  
>> of validation by intermediaries:  DNS has the property that any  
>> unknown record type should be treatable as an opaque blob of bits,  
>> including for the purpose of validation.
>
>One of us is radically misunderstanding the other.  It could be my  
>fault.
>
>The idea is that the DNSSEC validates the RR, just the same as any  
>other.  This gives you a trusted key.
>
>Then, in the course of TLS setup (for example), the client takes the  
>key that it got from the RR and compares that with the key it's  
>getting from the server (embedded in a cert or otherwise).  This is  
>happening in client libs, which might indeed need to be updated.
>
>None of this implicates changes to DNSSEC operations.
>
>What am I missing?

  I don't think your missing anything here.  Well done!
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827